Minipwner Tp-Link TL-MR3020 Guide

March 25, 2013 - 18:16 GNU/Linux 1 comment

This is a revised and simplified version, made by me, of the guide written on minipwner.com. Thanks to minipwner.com for making the file minipwner.tar available.
This guide is written specifically for the router Tp-Link TL-MR3020

Notice:
I am not responsible for any kind of damage. You choose to follow this guide at your own risk.

The distribution used for performing all the operations was Debian 7 Testing. However, it is possible to use any distribution.

Hardware required:
Tp-Link TL-MR3020
USB flash drive 4Gb (the Cruzer Fit is recommended for small size)

Repartition the USB flash drive as follows:
Partition 1: Linux Swap Device
Partition 2: ext4

Insert the USB stick into the router

Download the OpenWrt image for the TP-Link MR3020 from
http://downloads.openwrt.org/snapshots/trunk/ar71xx/

Download the files:
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

Download minipwner.tar from this link:
http://www.minipwner.com/images/minipwner.tar

connect the router to a power outlet and connect the Ethernet cable to the PC.

In the browser, type the address 192.168.0.254
Username: admin
Password: admin

Go to the system tools> firmware upgrade and load the firmware:
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

Click on the button upgrade and the firmware will be loaded. After that the router will reboot.

Disconnect the power source and reconnect it.

The new IP address of the router will be 192.168.1.1 (the web section will no longer work)

connect via telnet to the system
telnet 192.168.1.1

Change the router's password in the OpenWrt terminal
passwd

in OpenWrt terminal go to the tmp directory:
cd /tmp

Open a new terminal and go to the directory from where you downloaded the files

Execute this command:
rcp  openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/

Upgrade from OpenWrt terminal:
sysupgrade -v /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

After that the router will reboot.

Reconnect to the router using the following command:
ssh root@192.168.1.1

When prompted, enter the password.

Copy minipwner.tar to /usr/share.
From a new terminal go to the computer's directory where the minipwner.tar file is located.
Execute this command:
rcp  minipwner.tar root@192.168.1.1:/usr/share

From OpenWrt terminal type:
cd /usr/share
tar -xf minipwner.tar

Copy the MAC ADDRESS of the wireless card in order to be able to put in the new configuration file In order to do this it is necessary to enable wifi option from the file /etc/config/wireless
vi /etc/config/wireless

Find this line:
# REMOVE THIS LINE TO ENABLE WIFI
option disabled 1

Insert the # as shown here:
# REMOVE THIS LINE TO ENABLE WIFI
# option disabled 1

Save with :wq! and press enter.
Execute these commands:
wifi
ifconfig wlan0

Copy the mac ADDRESS in a text file (will be used several times).

Execute these commands:
cd /usr/share/minipwner
cp -f /etc/config/network /etc/config/network.orig
cp -f /etc/config/wireless /etc/config/wireless.orig
cp -f /etc/config/firewall /etc/config/firewall.orig
cp -f /etc/profile /etc/profile.orig
cp -f /etc/opkg.conf /etc/opkg.conf.orig
cp -f /etc/config/system /etc/config/system.orig
cp -f /etc/config/dhcp /etc/config/dhcp.orig
cp -f ./network.1 /etc/config/network
cp -f ./wireless.1 /etc/config/wireless
cp -f firewall.1 /etc/config/firewall


Edit the file /etc/config/wireless
vi /etc/config/wireless

Delete the old MAC ADDRESS and insert the previously copied one.

At this point it is necessary to configure the Wifi.
If your router has Open Wifi the only thing you need to do is to set the SSID of your router.
The default SSID is TOKI (Change TOKI with your SSID).

If you have a wireless network encryption (for example, WPA2 PSK), set up in this way:
Option encryption psk2+tkip
option key your_key

More info on OpenWrt Wiki

Save with :wq! and press enter.

Now restart the newtork:
/etc/init.d/network restart

Check that wlan0 has an assigned IP address.
ifconfig wlan0

If there are problems please troubleshoot.

Execute these commands:
cd /usr/share/minipwner
opkg update
opkg install kernel
opkg install kmod-usb-storage
opkg install kmod-fs-ext4
opkg install block-mount
cp -f profile.1 /etc/profile
cp -f fstab.1 /etc/config/fstab
cp -f opkg.conf.1 /etc/opkg.conf
cp -f system.1 /etc/config/system
mkdir /mnt/usb
/etc/init.d/fstab enable
/etc/init.d/fstab start
ls /mnt/usb

Check that the USB stick is mounted by "mount" or "df"

Execute these commands:
cd /usr/share/minipwner
ln -s /mnt/usb /opt
ln -s /etc /mnt/usb/etc
opkg update
opkg install netcat
opkg -dest usb install tar
opkg -dest usb install openssh-sftp-client
opkg -dest usb install nmap
opkg -dest usb install tcpdump
opkg -dest usb install aircrack-ng
opkg -dest usb install kismet-client
opkg -dest usb install kismet-server
opkg -dest usb install perl
opkg -dest usb install openvpn
opkg -dest usb install nbtscan
opkg -dest usb install snort
opkg -dest usb install karma
opkg -dest usb install samba36-client
opkg -dest usb install elinks
opkg -dest usb install yafc
cp -f /etc/config/wireless /etc/config/wireless.old
cp -f /etc/config/network /etc/config/network.old
cp -f /etc/config/dhcp /etc/config/dhcp.old
cp -f ./network.2 /etc/config/network
cp -f ./wireless.2 /etc/config/wireless
cp -f ./dhcp.2 /etc/config/dhcp
ln -s /mnt/usb/usr/share/nmap /usr/share/nmap

Edit /etc/config/wireless
vi /etc/config/wireless

Delete the old MAC address and paste the previously copied one.
Save and exit.
:wq!

Restart the router:
reboot

Minipwner is ready: Wireless access is open with SSID TOKI.
The new router IP is now 192.168.50.1

If you want to install additional packages in the USB, type:
opkg -dest usb install (packagename)
example:
opkg -dest usb install elinks

If there are problems in the libraries, in most cases they can be resolved with a symlink like this:
ln -s /mnt/usb/usr/share/nmap /usr/share/nmap

minipwner.com forum is very useful for resolving any kinds of problems.

Solution PT Activity 7.5.1: Packet Tracer Skills Integration Challenge

March 8, 2013 - 13:34 Cisco 3 comments

Questions and suggestions are welcome.

Task 1: Apply Basic Configurations
Step 1. Configure R1, R2, and R3 with the basic global configuration.
Hostname as listed in the addressing table
Console line for login with password cisco
vtys 0–4 for login with password cisco
Secret password class
Banner of “AUTHORIZED ACCESS ONLY!”
Only the hostname and banner are graded.

R1
Router>en
Router#conf t
Router(config)#Hostname R1
R1(config)#line con 0
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#enable secret class
R1(config)#banner motd "AUTHORIZED ACCESS ONLY!"
R1(config)#

R2
Router>en
Router#conf t
Router(config)#hostname R2
R2(config)#line con 0
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#line vty 0 4
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#enable secret class
R2(config)#banner motd "AUTHORIZED ACCESS ONLY!"
R2(config)#

R3
Router>en
Router#conf t
Router(config)#hostname R3
R3(config)#line con 0
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#line vty 0 4
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#enable secret class
R3(config)#banner motd "AUTHORIZED ACCESS ONLY!"
R3(config)#

Step 2. Configure the interfaces on R1, R2, and R3.
Use the addressing table to determine the interface addresses. Use the topology diagram to determine which interfaces are DCE interfaces. Configure the DCE interfaces for a clock rate of 64000.

R1
R1(config)#int f0/0
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int f0/1
R1(config-if)#ip address 192.168.11.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int s0/0/0
R1(config-if)#ip address 10.1.1.1 255.255.255.252
R1(config-if)#clock rate 64000
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#

R2
R2(config)#int f0/0
R2(config-if)#ip address 192.168.20.1 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int s0/0/0
R2(config-if)#ip address 10.1.1.2 255.255.255.252
R2(config-if)#no sh
R2(config-if)#int s0/0/1
R2(config-if)#ip address 10.2.2.1 255.255.255.252
R2(config-if)#clock rate 64000
R2(config-if)#no sh
R2(config-if)#int s0/1/0
R2(config-if)#ip address 209.165.200.225 255.255.255.224
R2(config-if)#no sh
R2(config-if)#exit
R2(config)#

R3
R3(config)#int f0/0
R3(config-if)#ip address 192.168.30.1 255.255.255.0
R3(config-if)#no sh
R3(config-if)#int s0/0/1
R3(config-if)#ip address 10.2.2.2 255.255.255.252
R3(config-if)#no sh
R3(config-if)#exit
R3(config)#

Task 2: Configure PPP Encapsulation with CHAP
Step 1. Configure the link between R1 and R2 to use PPP encapsulation with CHAP authentication.
The password for CHAP authentication is cisco123.

R1
R1(config)#int s0/0/0
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication chap
R1(config-if)#exit
R1(config)#username R2 password cisco123
R1(config)#

R2
R2(config)#int s0/0/0
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication chap
R2(config-if)#exit
R2(config)#username R1 password cisco123
R2(config)#

Step 2. Configure the link between R2 and R3 to use PPP encapsulation with CHAP authentication.
The password for CHAP authentication is cisco123.

R2
R2(config)#int s0/0/1
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication chap
R2(config-if)#exit
R2(config)#username R3 password cisco123
R2(config)#

R3
R3(config)#int s0/0/1
R3(config-if)#encapsulation ppp
R3(config-if)#ppp authentication chap
R3(config-if)#exit
R3(config)#username R2 password cisco123
R3(config)#

Step 3. Verify that connectivity is restored between the routers.
R2 should be able to ping both R1 and R3. The interfaces may take a few minutes to come back up. You can switch back and forth between Realtime and Simulation modes to speed up the process. Another possible workaround to this Packet Tracer behavior is to use the shutdown and no shutdown commands on the interfaces.

R2
R2#ping 10.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/5 ms

R2#ping 10.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms

Task 3: Configure Dynamic and Default Routing
Step 1. Configure R1, R2, and R3 to use the OSPF routing protocol.
Use a process ID of 1 when configuring OSPF on the routers.
Advertise all networks connected to R1 and R3, but do not send routing updates out the LAN interfaces.
On R2, do not advertise the 209.165.200.224 network, and do not send routing updates out the Fa0/0 or the Serial0/1/0 interfaces.

R1
R1(config)#router ospf 1
R1(config-router)#network 10.1.1.0 0.0.0.3 area 0
R1(config-router)#network 192.168.10.0 0.0.0.255 area 0
R1(config-router)#network 192.168.11.0 0.0.0.255 area 0
R1(config-router)#passive-interface f0/0
R1(config-router)#passive-interface f0/1
R1(config-router)#exit
R1(config)#

R2
R2(config)#router ospf 1
R2(config-router)#network 10.1.1.0 0.0.0.3 area 0
R2(config-router)#network 10.2.2.0 0.0.0.3 area 0
R2(config-router)#network 192.168.20.0 0.0.0.255 area 0
R2(config-router)#passive-interface f0/0
R2(config-router)#passive-interface s0/1/0
R2(config-router)#exit
R2(config)#

R3
R3(config)#router ospf 1
R3(config-router)#network 10.2.2.0 0.0.0.3 area 0
R3(config-router)#network 192.168.30.0 0.0.0.255 area 0
R3(config-router)#passive-interface f0/0
R3(config-router)#exit
R3(config)#

Step 2. Configure a default route on R2.
Configure a default route to ISP, specifying the outgoing interface on R2 as the next-hop address.

ISP(config)#ip route 209.165.202.128 255.255.255.224 s0/0/0

Step 3. Configure OSPF to advertise the default route.
On R2, enter the command to advertise the default route to R1 and R3 via OSPF.

R2
R2(config)#router ospf 1
R2(config-router)#default-information originate
R2(config-router)#exit
R2(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0
R2(config)#

Task 4: Configure Routers with Easy IP
Step 1. Configure R1 to act as a DHCP server for the 192.168.10.0 and 192.68.11.0 networks.
- Name the DHCP pool for the 192.168.10.0 network R1LAN1. For the 192.168.11.0 network, use the name R1LAN2.
- Exclude the first nine addresses on each network from dynamic assignment.
- In addition to the IP address and subnet mask, assign the default gateway and DNS server addresses.

R1(config)#ip dhcp pool R1LAN1
R1(dhcp-config)#network 192.168.10.0 255.255.255.0
R1(dhcp-config)#default-router 192.168.10.1
R1(dhcp-config)#dns-server 192.168.20.254
R1(dhcp-config)#exit
R1(config)#ip dhcp excluded-address 192.168.10.1 192.168.10.9
R1(config)#ip dhcp excluded-address 192.168.11.1 192.168.11.9
R1(config)#ip dhcp pool R1LAN2
R1(dhcp-config)#network 192.168.11.0 255.255.255.0
R1(dhcp-config)#default-router 192.168.11.1
R1(dhcp-config)#dns-server 192.168.20.254
R1(dhcp-config)#exit
R1(config)#

Step 2. Configure R3 to act as a DHCP server for the 192.168.30.0 network.
Name the DHCP pool for the 192.168.30.0 network R3LAN.
Exclude the first nine addresses on each network from dynamic assignment.
In addition to the IP address and subnet mask, assign the default gateway and DNS server addresses.

R3(config)#ip dhcp pool R3LAN
R3(dhcp-config)#network 192.168.30.0 255.255.255.0
R3(dhcp-config)#default-router 192.168.30.1
R3(dhcp-config)#dns-server 192.168.20.254
R3(dhcp-config)#exit
R3(config)#ip dhcp excluded-address 192.168.30.1 192.168.30.9
R3(config)#

Task 5: Verify that PCs Are Automatically Configured with Addressing Details
Step 1. Configure PC1, PC2, and PC3 for automatic IP configuration using DHCP.
Go to each PC and in config > global select DHCP

Step 2. Verify that each PC has an address assigned from the correct DHCP pool.
Check the IP

Task 6: Configure a DNS Server with DNS Entries
Step 1. Configure the DNS server.
To configure DNS on the Inside Server, click the DNS button in the Config tab.
Make sure that DNS is turned on, and enter the following DNS entry:
www.cisco.com     209.165.201.30

Go to Inside Server
Config > DNS
name: www.cisco.com
Address: 209.165.201.30
Click Add

Task 7: Configure an ACL to Permit NAT
Step 1. Create a standard named ACL.
Create the standard named ACL, R2NAT, which permits all the internal networks to be mapped by NAT.
Note: For Packet Tracer to grade this task correctly, you must enter the permitted networks in the following order:
192.168.10.0
192.168.20.0
192.168.30.0
192.168.11.0

R2(config)#ip access-list standard R2NAT
R2(config-std-nacl)#permit 192.168.10.0 0.0.0.255
R2(config-std-nacl)#permit 192.168.20.0 0.0.0.255
R2(config-std-nacl)#permit 192.168.30.0 0.0.0.255
R2(config-std-nacl)#permit 192.168.11.0 0.0.0.255
R2(config-std-nacl)#exit
R2(config)#int fa0/0
R2(config-if)#ip access-group R2NAT in
R2(config-if)#exit
R2(config)#

Task 8: Configure Static NAT
Step 1. Configure static NAT for an inside web server.
Configure static NAT to map the local IP address and global IP addresses for Inside Server. Use the addresses listed in the addressing table.

R2(config)#ip nat inside source static 192.168.20.254 209.165.202.131

Task 9: Configure Dynamic NAT with Overload
Step 1. Configure the dynamic NAT pool.
Configure a dynamic NAT address pool using the Nat Pool specified in the topology diagram. Name the address pool R2POOL.

R2(config)#ip nat pool R2POOL 209.165.202.129 209.165.202.130 netmask 255.255.255.252

Step 2. Configure the dynamic NAT mapping.
Map the addresses in R2POOL to the networks defined above in R2NAT.

R2(config)#ip nat inside source list R2NAT pool R2POOL overload

Step 3. Apply NAT to the internal and external interfaces of R2.

R2(config)#int fa0/0
R2(config-if)#ip nat inside
R2(config-if)#int s0/0/0
R2(config-if)#ip nat inside
R2(config-if)#int s0/0/1
R2(config-if)#ip nat inside
R2(config-if)#int s0/1/0
R2(config-if)#ip nat outside
R2(config-if)#exit
R2(config)#

Task 10: Configure the ISP Router with a Static Route
Step 1. Configure a static route to the global IP addresses of R2.
This is the 209.165.202.128/27 network. Use the serial interface of ISP as the next-hop address.

ISP(config)#ip route 209.165.202.128 255.255.255.224 s0/0/0


Task 11: Test Connectivity
Inside hosts should be able to ping Outside Host.
PC3
PC>ping 209.165.201.14

Pinging 209.165.201.14 with 32 bytes of data:

Reply from 209.165.201.14: bytes=32 time=100ms TTL=125
Reply from 209.165.201.14: bytes=32 time=72ms TTL=125
Reply from 209.165.201.14: bytes=32 time=90ms TTL=125
Reply from 209.165.201.14: bytes=32 time=100ms TTL=125

Ping statistics for 209.165.201.14:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 72ms, Maximum = 100ms, Average = 90ms

PC>

Inside hosts should be able to ping www.cisco.com.
PC3
PC>ping www.cisco.com

Pinging 209.165.201.30 with 32 bytes of data:

Reply from 209.165.201.30: bytes=32 time=90ms TTL=125
Reply from 209.165.201.30: bytes=32 time=80ms TTL=125
Reply from 209.165.201.30: bytes=32 time=92ms TTL=125
Reply from 209.165.201.30: bytes=32 time=92ms TTL=125

Ping statistics for 209.165.201.30:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 80ms, Maximum = 92ms, Average = 88ms

PC>

Outside Host should be able to ping Inside Server by its global IP address.
PC-PT
PC>ping 209.165.202.131

Pinging 209.165.202.131 with 32 bytes of data:

Reply from 209.165.202.131: bytes=32 time=50ms TTL=126
Reply from 209.165.202.131: bytes=32 time=40ms TTL=126
Reply from 209.165.202.131: bytes=32 time=60ms TTL=126
Reply from 209.165.202.131: bytes=32 time=60ms TTL=126

Ping statistics for 209.165.202.131:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 40ms, Maximum = 60ms, Average = 52ms

PC>

Solution PT Activity 6.4.1: Packet Tracer Skills Integration Challenge

January 5, 2013 - 12:09 Cisco 3 comments

Questions and suggestions are welcome.

Task 1: Apply Basic Router Configurations
Step 1: Configure basic commands.
Using the information in the topology diagram and addressing table, configure the basic device configurations on R1, R2, and R3. Hostnames are configured for you.

R1
R1>en
R1#conf t
R1(config)#line con 0
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#banner motd "Access to Router R1"
R1(config)#no ip domain-lookup
R1(config)#int s0/0/0
R1(config-if)#description line to cloud-PT
R1(config-if)#exit
R1(config)#int f0/0
R1(config-if)#desc
R1(config-if)#description fastethernet LAN
R1(config-if)#exit
R1(config-if)#

R2
R2>en
R2#conf t
R2(config)#line con 0
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#line vty 0 4
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#banner motd "Access to Router R2"
R2(config)#no ip domain-lookup
R2(config)#int s0/0/0
R2(config-if)#description line to cloud-PT
R2(config-if)#exit
R2(config)#int s0/1/0
R2(config-if)#description line to ISP
R2(config-if)#exit
R2(config)#int f0/0
R2(config-if)#description line to LAN
R2(config-if)#exit
R2(config)#

R3
R3>en
R3#conf t
R3(config)#line con 0
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#line vty 0 4
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#banner motd "Access to Router R3"
R3(config)#no ip domain-lookup
R3(config)#int s0/0/0
R3(config-if)#description line to cloud-PT
R3(config-if)#exit
R3(config)#int f0/0
R3(config-if)#description line to LAN
R3(config-if)#exit
R3(config)#

Task 2: Configure Dynamic and Default Routing
Step 1. Configure default routing.
R2 needs a default route. Use the exit-interface argument in the default route configuration.

R2(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0

Step 2. Configure dynamic routing.
Configure RIPv2 on R1, R2, and R3 for all available networks. R2 needs to pass its default network configuration to the other routers. Also, be sure to use the passive-interface command on all active interfaces not used for routing.

R1
R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#network 10.1.1.0
R1(config-router)#network 192.168.10.0
R1(config-router)#passive-interface f0/1
R1(config-router)#no auto-summary
R1(config-router)#exit
R1(config)#

R2
R2(config)#router rip
R2(config-router)#version 2
R2(config-router)#network 10.1.1.0
R2(config-router)#network 192.168.20.0
R2(config-router)#default-information originate
R2(config-router)#passive-interface s0/1/0
R2(config-router)#passive-interface f0/1
R2(config-router)#no auto-summary
R2(config-router)#exit
R2(config)#

R3
R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#network 10.1.1.0
R3(config-router)#network 192.168.30.0
R3(config-router)#passive-interface f0/1
R3(config-router)#no auto-summary
R3(config-router)#exit
R3(config)#

Task 5: Apply ACL Policies
Step 1. Create and apply security policy number 1.
Implement the following ACL rules using ACL number 101:
Allow hosts on the 192.168.30.0/24 network web access to any destination.
Allow hosts on the 192.168.30.0/24 network ping access to any destination.
Deny any other access originating from the network.

R3
R3(config)#access-list 101 permit tcp 192.168.30.0 0.0.0.255 any eq www
R3(config)#access-list 101 permit icmp 192.168.30.0 0.0.0.255 any
R3(config)#access-list 101 deny ip any any
R3(config)#int fa0/1
R3(config-if)#ip access-group 101 in
R3(config-if)#exit
R3(config)#

Step 2. Create and apply security policy number 2.
Because ISP represents connectivity to the Internet, configure a named ACL called FIREWALL in the following order:
Allow TW-DSL web access to the Intranet server.
Allow TW-Cable web access to the Intranet server.
Allow only inbound ping replies from ISP and any source beyond ISP.
Allow only established TCP sessions from ISP and any source beyond ISP.
Explicitly block all other inbound access from ISP and any source beyond ISP.

R2
R2(config)#ip access-list extended FIREWALL
R2(config-ext-nacl)#permit tcp host 192.168.1.10 host 192.168.20.254 eq www
R2(config-ext-nacl)#permit tcp host 192.168.2.10 host 192.168.20.254 eq www
R2(config-ext-nacl)#permit icmp any any echo-reply
R2(config-ext-nacl)#permit tcp any any established
R2(config-ext-nacl)#deny ip any any
R2(config-ext-nacl)#int s0/1/0
R2(config-if)#ip access-group FIREWALL in
R2(config-if)#exit
R2(config)#

Solution PT Activity 5.6.1: Packet Tracer Skills Integration Challenge

January 4, 2013 - 15:09 Cisco no comments

Task 1: Configure PPP with CHAP Authentication
Step 1. Configure the link between HQ and B1 to use PPP encapsulation with CHAP authentication.
The password for CHAP authentication is cisco123.

B1
User Access Verification
Password: cisco
B1>en
Password: class
B1#conf t
B1(config)#int s0/0/0
B1(config-if)#encapsulation ppp
B1(config-if)#ppp authentication chap
B1(config-if)#exit
B1(config)#username HQ password cisco123

HQ
User Access Verification
Password: cisco
HQ>en
Password: class
HQ#conf t
HQ(config)#int s0/0/0
HQ(config-if)#encapsulation ppp
HQ(config-if)#ppp authentication chap
HQ(config-if)#exit
HQ(config)#username B1 password cisco123

Step 2. Configure the link between HQ and B2 to use PPP encapsulation with CHAP authentication.
The password for CHAP authentication is cisco123.

HQ
HQ(config)#
HQ(config)#int s0/0/1
HQ(config-if)#encapsulation ppp
HQ(config-if)#ppp authentication chap
HQ(config-if)#exit
HQ(config)#username B2 password cisco123

B2
User Access Verification
Password: cisco
B2>en
Password: class
B2#conf t
B2(config)#int s0/0/0
B2(config-if)#encapsulation ppp
B2(config-if)#ppp authentication chap
B2(config-if)#exit
B2(config)#username HQ password cisco123

Step 3. Verify that connectivity is restored between the routers.
HQ should be able to ping both B1 and B2. The interfaces may take a few minutes to come back up. You can switch back and forth between Realtime and Simulation mode to speed up the process. Another possible workaround to this Packet Tracer behavior is to use the shutdown and no shutdown commands on the interfaces.

HQ
HQ#ping 10.1.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/6 ms

HQ#ping 10.1.1.6

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/5 ms

Task 2: Configure Default Routing
Step 1. Configure default routing from HQ to ISP.
Configure a default route on HQ using the exit interface argument to send all default traffic to ISP.

HQ
HQ(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0

Step 2. Test connectivity to Web Server.
HQ should be able to successfully ping Web Server at 209.165.202.130 as long as the ping is sourced from the Serial0/1/0 interface.

HQ#ping 209.165.202.130

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.202.130, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/7/9 ms

Task 3: Configure OSPF Routing
Step 1. Configure OSPF on HQ.
- Configure OSPF using the process ID 1.
- Advertise all subnets except the 209.165.201.0 network.
- Propagate the default route to OSPF neighbors.
- Disable OSPF updates to ISP and to the HQ LANs.

HQ
HQ(config)#router ospf 1
HQ(config-router)#network 10.1.1.4 0.0.0.3 area 0
HQ(config-router)#network 10.1.1.0 0.0.0.3 area 0
HQ(config-router)#network 10.1.50.0 0.0.0.255 area 0
HQ(config-router)#network 10.1.40.0 0.0.0.255 area 0
HQ(config-router)#default-information originate
HQ(config-router)#passive-interface S0/1/0
HQ(config-router)#passive-interface f0/0
HQ(config-router)#passive-interface f0/1
HQ(config-router)#exit

Step 2. Configure OSPF on B1 and B2.

- Configure OSPF using the process ID 1.
- On each router, configure the appropriate subnets.
- Disable OSPF updates to the LANs.

B1
B1(config)#router ospf 1
B1(config-router)#network 10.1.1.0 0.0.0.3 area 0
B1(config-router)#network 10.1.10.0 0.0.0.255 area 0
B1(config-router)#network 10.1.20.0 0.0.0.255 area 0
B1(config-router)#passive-interface f0/0
B1(config-router)#passive-interface f0/1
B1(config-router)#exit

B2
B2(config)#router ospf 1
B2(config-router)#network 10.1.1.4 0.0.0.3 area 0
B2(config-router)#network 10.1.70.0 0.0.0.255 area 0
B2(config-router)#network 10.1.80.0 0.0.0.255 area 0
B2(config-router)#passive-interface f0/0
B2(config-router)#passive-interface f0/1
B2(config-router)#exit

Task 4: Implement Multiple ACL Security Policies
Step 1. Implement security policy number 1.
Block the 10.1.10.0 network from accessing the 10.1.40.0 network. All other access to 10.1.40.0 is allowed. Configure the ACL on HQ using ACL number 10.
Use a standard or extended ACL? standard
Apply the ACL to which interface? f0/1
Apply the ACL in which direction? OUT

HQ
HQ(config)#access-list 10 deny 10.1.10.0 0.0.0.255
HQ(config)#access-list 10 permit any
HQ(config)#int fa0/1
HQ(config-if)#ip access-group 10 out

Step 4. Implement security policy number 2.
Host 10.1.10.5 is not allowed to access host 10.1.50.7. All other hosts are allowed to access 10.1.50.7. Configure the ACL on B1 using ACL number 115.
Use a standard or extended ACL? extended
Apply the ACL to which interface? f0/0
Apply the ACL in which direction? IN

B1
B1(config)#access-list 115 deny ip host 10.1.10.5 host 10.1.50.7
B1(config)#access-list 115 permit ip any any
B1(config)#int fa0/0
B1(config-if)#ip access-group 115 in

Step 7. Implement security policy number 3.
Hosts 10.1.50.1 through 10.1.50.63 are not allowed web access to Intranet server at 10.1.80.16. All other access is allowed. Configure the ACL on the appropriate router and use ACL number 101.
Use a standard or extended ACL? extended
Configure the ACL on which router? HQ
Apply the ACL to which interface? f0/0
Apply the ACL in which direction? IN

HQ
HQ(config)#access-list 101 deny tcp 10.1.50.0 0.0.0.63 host 10.1.80.16 eq www
HQ(config)#access-list 101 permit ip any any
HQ(config)#interface fa0/0
HQ(config-if)#ip access-group 101 in

Step 10. Implement security policy number 4.
Use the name NO_FTP to configure a named ACL that blocks the 10.1.70.0/24 network from accessing FTP services (port 21) on the file server at 10.1.10.2. All other access should be allowed.
Note: Names are case-sensitive.
Use a standard or extended ACL? extended
Configure the ACL on which router? B2
Apply the ACL to which interface? f0/1
Apply the ACL in which direction? IN

B2
B2(config)#ip access-list extended NO_FTP
B2(config-ext-nacl)#deny tcp 10.1.70.0 0.0.0.255 host 10.1.10.2 eq ftp
B2(config-ext-nacl)#permit ip any any
B2(config-ext-nacl)#interface fa0/1
B2(config-if)#ip access-group NO_FTP in

Step 12. Implement security policy number 5.
Since ISP represents connectivity to the Internet, configure a named ACL called FIREWALL in the following order:
Allow only inbound ping replies from ISP and any source beyond ISP.
Allow only established TCP sessions from ISP and any source beyond ISP.
Explicitly block all other inbound access from ISP and any source beyond ISP
Use a standard or extended ACL? extended
Configure the ACL on which router? HQ
Apply the ACL to which interface? s0/1/0
Apply the ACL in which direction? IN

HQ
HQ(confi)#ip access-list extended FIREWALL
HQ(config-ext-nacl)#permit icmp any any echo-reply
HQ(config-ext-nacl)#permit tcp any any established
HQ(config-ext-nacl)#deny ip any any
HQ(config-ext-nacl)#interface s0/1/0
HQ(config-if)#ip access-group FIREWALL in